Authorizing...

Authorizing... Click here if not redirected

\n\n`;\n\n return new Response(html, {\n status: 200,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n // Explicitly allow all form actions including claude:// scheme\n \"Content-Security-Policy\":\n \"default-src 'self' 'unsafe-inline'; form-action *; frame-ancestors 'none';\",\n ...corsHeaders(),\n },\n });\n}\n\nasync function handleToken(req) {\n // Parse the form-encoded body\n let bodyText = \"\";\n try {\n bodyText = await req.text();\n console.log(\"TOKEN request body:\", bodyText.slice(0, 500));\n } catch (e) {\n console.log(\"TOKEN: could not read body:\", e.message);\n }\n\n const params = new URLSearchParams(bodyText);\n console.log(\n \"TOKEN grant_type:\",\n params.get(\"grant_type\"),\n \"client_id:\",\n params.get(\"client_id\"),\n );\n\n // Validate client credentials\n if (!validateClient(params)) {\n console.log(\"TOKEN: invalid client credentials\");\n return corsJson({ error: \"invalid_client\" }, 401);\n }\n\n // Issue a bearer token\n const token = \"wc_token_\" + crypto.randomUUID().replace(/-/g, \"\");\n const response = {\n access_token: token,\n token_type: \"Bearer\",\n expires_in: 86400,\n scope: \"read write\",\n refresh_token: \"wc_refresh_\" + crypto.randomUUID().replace(/-/g, \"\"),\n };\n console.log(\"TOKEN response:\", JSON.stringify(response));\n return corsJson(response);\n}\n\n// ── HTTP Router ──\n\nexport default async function (req) {\n const url = new URL(req.url);\n const path = url.pathname;\n\n // Log EVERY request for debugging\n console.log(\n `${req.method} ${path} ${url.search ? url.search.slice(0, 80) : \"\"}`,\n );\n\n // CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: corsHeaders() });\n }\n\n // Force .well-known to 404 — prevents Claude.ai from entering OAuth flow\n if (path.startsWith(\"/.well-known/\")) {\n console.log(\"BLOCKED .well-known:\", path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n }\n\n // MCP endpoint — no auth required\n if (path === \"/mcp\" && req.method === \"POST\") {\n return handleMcp(req);\n }\n\n // OAuth endpoints DISABLED — Claude.ai falls back to these default paths\n // even when .well-known returns 404, triggering a broken OAuth flow.\n // Return 404 to force Claude to use the unauthenticated connection.\n if (\n (path === \"/register\" || path === \"/authorize\" || path === \"/token\") &&\n !url.searchParams.has(\"force_oauth\")\n ) {\n console.log(\"BLOCKED OAuth fallback:\", req.method, path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n }\n\n // Seed endpoint (no auth required — called by build.sh)\n if (path === \"/seed\" && req.method === \"POST\") {\n return handleSeed(req);\n }\n\n // Health check\n if (path === \"/\" && req.method === \"GET\") {\n return corsJson({\n name: SERVER_INFO.name,\n version: SERVER_INFO.version,\n status: \"ok\",\n tools: TOOLS.length,\n endpoint: \"/mcp\",\n });\n }\n\n console.log(\"404 UNMATCHED:\", req.method, path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n}\n\n// ── Helpers ──\n\nfunction corsHeaders() {\n return {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS, DELETE\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, Accept, Mcp-Session-Id\",\n \"Access-Control-Expose-Headers\": \"Mcp-Session-Id\",\n };\n}\n\nfunction corsJson(data, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...corsHeaders(),\n },\n });\n}\n\nfunction escapeHtml(str) {\n return str.replace(/&/g, \"&\").replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\nfunction slugify(text) {\n return text\n .toLowerCase()\n .replace(/[^\\w\\s-]/g, \"\")\n .replace(/\\s+/g, \"-\")\n .replace(/-+/g, \"-\")\n .replace(/^-|-$/g, \"\");\n}","deleted","label",[107],"pulls","branches",1,"forks","envVars",{"_131":39,"_133":39},"connections",{"_131":39,"_132":39},"count","unfilledCount","emptyCount",{"_18":106,"_20":107,"_108":109,"_110":-5,"_111":65,"_112":63,"_113":100,"_22":135,"_62":115,"_116":117,"_118":119,"_120":26,"_121":-5,"_136":137,"_82":138},["D",1771914096109],"children",[],[107],["D",1771908274004],{"_16":17,"_80":76},{"_16":17,"_74":-5,"_75":76,"_32":33,"_77":78,"_79":26},{"_62":63,"_20":64,"_18":65,"_66":19,"_67":-5,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":21,"_73":17},"ctx",{"_55":-5,"_102":176,"_177":178,"_179":180,"_181":26,"_182":26,"_183":26,"_184":100,"_185":-5,"_186":-7,"_187":-7,"_188":39,"_189":26,"_190":26,"_191":-5,"_192":26,"_193":26,"_194":26,"_195":-5},"ENV",{"_147":148,"_149":150,"_151":64,"_152":153,"_154":155,"_156":157,"_158":159,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]